THREAT OPS › Threat News › [NVD] CVE-2026-15038 — The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an adm
[NVD] CVE-2026-15038 — The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an adm
CVE-2026-15038 CVSS: None Published: 2026-08-09T06:17:16.393
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, lea
Indicators of compromise
- CVE-2026-15038cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-15038